Talk:Ernie

Manuals

• https://www.sendspace.com/file/29rxmb (Pages 43,44)
• https://www.sendspace.com/file/6ms5li (KH3 Variant)
• https://www.sendspace.com/file/yntoc1 (KX3-L Variants)
• https://www.sendspace.com/file/pu5es2 (KX3-L Flash Programming)

Attack Manuals

• https://www.sendspace.com/file/akkej6

Table

Production Start Date (<=)	PS2 Mechacon	PSP Syscon	PS3 Syscon	PSVita Syscon	PS4 Syscon	Used IC/CPU Core
07/2010	-	-	-	"SC"	-	NEC D79F0109 / -------- (78K0R/KH3, 121 pin)
08/2013	-	-	-	A0xxx	-	Renesas R5F1ZCRK (RL78/G13, 121 pin)

"Stripping" Ernie updates

import struct
from binascii import unhexlify as uhx
from binascii import hexlify as hx
from Crypto.Cipher import AES

import os
import sys

def aes_decrypt_cbc(key, iv, input):
    return AES.new(key, AES.MODE_CBC, iv).decrypt(input)

def main(argc, argv):    
    with open(sys.argv[1], 'rb') as g:
        data3 = g.read(0x30)
        magic = b'\x20\x18\x00\x00'
        while(magic not in data3):
            data3 = g.read(0x400)
            with open(sys.argv[2], 'ab') as h:
                h.write(data3)
            data3 = g.read(0x10) 
    with open(sys.argv[2], 'rb') as i:
        middledata = i.read()
        dec = aes_decrypt_cbc('523BEB53FCB95DC772AA1BFB0A96CD10'.decode('hex'),'385D67E50CE7669ECD171FE576814343'.decode('hex'),middledata)
        with open(sys.argv[3], 'wb') as j:
            j.write(dec)
    


if __name__ == '__main__':
    main(len(sys.argv), sys.argv)